CVE-2023-24236

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules...

Command injection

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules...

Command injection

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules...

CVE-2023-24238

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules...

CVE-2023-24238: Improper Neutralization of Special Elements used in a Command

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules...

PT-2023-19492

Name of the Vulnerable Software and Affected Versions TOTOlink A7100RU version 7.4cu.2313 B20191024 Description A command injection issue was discovered via the province parameter at the "setting/delStaticDhcpRules" endpoint. This allows for potential exploitation. No information is provided abou...

PT-2023-19493

Name of the Vulnerable Software and Affected Versions TOTOlink A7100RU version V7.4cu.2313 B20191024 Description A command injection issue was discovered via the city parameter at the "setting/delStaticDhcpRules" endpoint. This allows for potential exploitation. No information is provided about t...

CVE-2023-24236

The CVE-2023-24236 entry affects TOTOLINK A7100RU (V7.4cu.2313_B20191024). A command injection vulnerability exists in the PROVINCE parameter within the setting/delStaticDhcpRules workflow, enabling potential remote command execution from a network attacker. CVSS 3.1 base score 9.8 (CRITICAL) wit...

CVE-2023-24236: Improper Neutralization of Special Elements used in a Command

TOTOlink A7100RUV7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules...

SUSE CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request...

SUSE CVE-2009-0754

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.funcoverload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server...

SUSE CVE-2011-1943

The destroyonesecret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file...

SUSE CVE-2011-2167

script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script...

SUSE CVE-2014-3620

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain...

SUSE CVE-2015-7187

The Add-on SDK in Mozilla Firefox before 42.0 misinterprets a "script: false" panel setting, which makes it easier for remote attackers to conduct cross-site scripting XSS attacks via inline JavaScript code that is executed within a third-party extension...

SUSE CVE-2016-5162

The AllowCrossRendererResourceLoad function in extensions/browser/urlrequestutil.cc in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly use an extension's manifest.json webaccessibleresources field for restrictions on IFRAME elements, which...

SUSE CVE-2017-6463

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service daemon crash via an invalid setting in a :config directive, related to the unpeer option...

SUSE CVE-2017-7837

SVG loaded through "" tags can use "" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox 57...

SUSE CVE-2019-18836

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continueonlistenerfilterstimeout is used."...

SUSE CVE-2021-20297

A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability...